what should you use to attempt breaking valid sql request

What is the first character that Bob should use to attempt breaking valid SQL request?